Post

ssrf protection being so underbaked in pretty much any toolkit is really disappointing and feels like some kind of indication of how little people cares about communicating with any machine not their own. "Just Allowlist Everyone In The Firewall 4Head" should not be The Solution

iceshrimp.net is stuck using http/2 for the foreseeable future because dotnet's http/3 does not seem to expose the ability for us to create our own socket for the connection to go through, all just to validate that the IP we're connecting to is not local.

dns is not enough because you Can Just do `http://127.0.0.1`, and checking the domains ahead-of-time is obvious TOCTOU

(triggered by the recent mastodon release which had a ssrf bypass involving a weird uncommon ipv6 feature, which is not unexpected when everyone's expected to build this from scratch. at least in dotnet we can check IpAddress.IsLoopback and friends and if that breaks it's not our bug)

this mighe be solvable at a firewall layer, but that's another complication in deployment to go wrong / invisibly get ignored by people (or worse, "one click deployment") throwing a dockerfile at the wall

in an adjacent point to the ending bit, reverse proxy configuration and cache middleware also share the same deployment concerns and only really result in people refusing to support any reverse proxy and cache not their own (see: bluesky pds scripts hardcoding caddy).